Internet of Things (IoT) devices may be securely provisioned using a device provisioning service. For example, a smart door lock can connect to a device provisioning service designated by its manufacturer. The device provisioning service registers the smart door lock with an IoT hub and returns IoT hub connection information to the smart door lock. With this IoT hub connection information, the smart door lock can establish an initial connection with the IoT hub, which can apply the proper configuration to the smart door lock and establish interaction between the smart door lock and any appropriate IoT solutions (e.g., a security service, a home automation service). In the interest of security, such a device provisioning service will likely attempt to determine whether the device identity professed by the smart door lock is valid, so as to only provision validly-identified devices. However, existing solutions for determining the validity of a device identity by a device provisioning service are limited and not extensible, such as by the device user or the IoT solution provider.